提交 724f9e0d 编写于 作者: J Jesse Glick

Strengthening the reverse proxy admin monitor to detect nontransparent slash encoding (/ vs. %2F).

Apache in its default configuration botches this: http://stackoverflow.com/a/9933890/12916
上级 c528b95c
......@@ -25,12 +25,10 @@ package hudson.diagnosis;
import hudson.Extension;
import hudson.model.AdministrativeMonitor;
import hudson.util.FormValidation;
import org.kohsuke.stapler.HttpRedirect;
import org.kohsuke.stapler.HttpResponse;
import org.kohsuke.stapler.HttpResponses;
import org.kohsuke.stapler.QueryParameter;
import org.kohsuke.stapler.WebMethod;
import java.io.IOException;
......@@ -54,12 +52,15 @@ public class ReverseProxySetupMonitor extends AdministrativeMonitor {
}
public HttpResponse doTest() {
return new HttpRedirect("test-for-reverse-proxy-setup");
return new HttpRedirect("testForReverseProxySetup/a%2Fb/");
}
@WebMethod(name="test-for-reverse-proxy-setup")
public FormValidation doFoo() {
return FormValidation.ok();
public void getTestForReverseProxySetup(String rest) {
if (rest.equals("a/b")) {
throw HttpResponses.ok();
} else {
throw HttpResponses.errorWithoutStack(404, "expected a/b but got " + rest);
}
}
/**
......
/*
* The MIT License
*
* Copyright 2014 Jesse Glick.
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in
* all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
* THE SOFTWARE.
*/
package hudson.diagnosis;
import org.junit.Test;
import org.junit.Rule;
import org.jvnet.hudson.test.JenkinsRule;
public class ReverseProxySetupMonitorTest {
@Rule public JenkinsRule r = new JenkinsRule();
@Test public void normal() throws Exception {
r.createWebClient().goTo(r.jenkins.getAdministrativeMonitor(ReverseProxySetupMonitor.class.getName()).getUrl() + "/test", null);
}
}
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册